topic metrics - if field not present in raw data how to add it with default value? in Getting Data In

metrics - if field not present in raw data how to add it with default value?

imrago — Fri, 06 Sep 2019 15:13:28 GMT

In the data source I am ingesting it can happen that one of the fields is not present from time to time. The issue is when I am running a search on it and if I add that dimension to the query that event is not part of the calculation. 

Is it possible to somehow add a field to metrics with a default value if it is not present in the raw event?

Re: metrics - if field not present in raw data how to add it with default value?

solarboyz1 — Fri, 06 Sep 2019 15:22:14 GMT

Have you tried something like:

 index=YOURINDEX   FIELD_Name>*  OR NOT FIELD_name
| eval FIELD_Name=if(isnotnull(FIELD_Name), FIELD_Name, "Default value to fill in")

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/NOTexpressions

Re: metrics - if field not present in raw data how to add it with default value?

imrago — Fri, 06 Sep 2019 15:46:49 GMT

Agreed, that would work in regular indexes, but I need it for metrics based indexes.